WordPress HTTP2Shell Exposure - Brotli Memory Corruption via XML-RPC (CVE-2026-111497)

CVE-2026-111497 is an actively exploited Brotli memory-corruption flaw reachable through WordPress XML-RPC pingback on vulnerable hosts. Patch the system library and restrict the temporary attack paths.

WordPress sites can be exposed to the actively exploited Brotli decoder vulnerability CVE-2026-111497 even though WordPress does not bundle Brotli. On affected hosts, an unauthenticated XML-RPC pingback can make WordPress fetch an attacker-controlled URL. A malicious Brotli-compressed response is then decoded by the operating system’s libcurl/Brotli stack before WordPress sees the body, potentially crashing a PHP worker or corrupting process memory.

Table of Contents

Vulnerability summary

Component: Google Brotli decoder used through libcurl
CVE: CVE-2026-111497
Nickname: HTTP2Shell / Node2Shell
Affected upstream Brotli versions: 1.0.3 through 1.2.0
Fixed upstream releases: 1.0.10, 1.1.1 and 1.2.1, depending on branch
Weakness: Out-of-bounds write / memory corruption
Severity: Critical; Google scored the issue 9.2
Authentication: None for the WordPress pingback route
Confirmed WordPress impact: PHP/Apache worker crash or sustained CPU exhaustion
Potential CVE impact: Memory disclosure, denial of service and code execution
CISA KEV: Added October 27, 2026; remediation due November 10, 2026 for covered federal systems

CISA lists CVE-2026-111497 as known exploited. Public research has reproduced an unauthenticated WordPress worker crash through pingback. Remote code execution has not been publicly established for the PHP/Apache or PHP-FPM WordPress path, so administrators should not treat a crash as proof of code execution. The confirmed denial-of-service path is sufficient to require urgent remediation.

How WordPress reaches the vulnerable decoder

The easiest WordPress path is the unauthenticated pingback.ping method exposed through xmlrpc.php. The attacker supplies a public source URL. WordPress validates the URL and performs an outbound request with wp_safe_remote_get(). If the remote server answers with a malformed body marked Content-Encoding: br, libcurl passes it into the host’s Brotli decoder.

The memory corruption occurs below PHP, before WordPress can inspect the response. This is why an ordinary inbound WAF rule cannot identify the malicious Brotli stream: the dangerous data arrives in the outbound request’s response, not in the original POST. The same decoder may also be reached by plugins or themes that fetch user-controlled URLs, oEmbed discovery and configured feeds.

Who is exposed

WordPress runs on a host or container whose libcurl stack uses a vulnerable Brotli decoder.
The site exposes xmlrpc.php with pingback.ping, or another reachable feature makes server-side requests to attacker-controlled URLs.
The outbound HTTP client accepts and automatically decodes Brotli responses.

Updating WordPress core or a security plugin does not replace the vulnerable system library. Linux distributions may backport the fix without changing the visible upstream version number, so verify the installed package revision against the security advisory for the exact operating system release.

Required fix

Patch the Brotli library supplied by the operating system or rebuild the container image with the fixed package. This is the only remediation that fixes the vulnerable decoder. Install the vendor’s security update for libbrotli1, brotli or the equivalent package, then restart PHP-FPM, Apache and any long-running application processes that loaded the old library.

# Debian and Ubuntu: inspect the package revision
dpkg-query -W -f='${Package} ${Version}\n' libbrotli1

# Red Hat-family systems: inspect installed Brotli packages
rpm -qa | grep -i brotli

# Check whether PHP's libcurl advertises Brotli support
php -r 'var_export(curl_version());'

Do not decide that a host is vulnerable or safe from the upstream version string alone. Debian and Ubuntu commonly retain an upstream-looking 1.1.0 version while adding the correction in the distribution package revision. Compare the full package revision with the relevant vendor security notice.

Temporary WordPress mitigation

Temporary mitigation only: if the system package cannot be updated immediately, prevent libcurl from automatically decoding compressed responses. Place the following code in a must-use plugin, test outbound integrations, and remove it after the operating-system fix is verified.

<?php
/**
 * Plugin Name: Temporary HTTP2Shell Brotli Mitigation
 * Description: Prevents libcurl from auto-decoding outbound HTTP responses.
 */

add_action( 'http_api_curl', function ( $handle ) {
    curl_setopt( $handle, CURLOPT_ENCODING, 'identity' );
    curl_setopt( $handle, CURLOPT_HTTP_CONTENT_DECODING, 0 );
}, 10, 1 );

This closes the Brotli decoding path used by WordPress HTTP requests, but it does not patch Brotli for other software on the server.

Disable the unauthenticated pingback route

Removing the pingback methods closes the easiest unauthenticated WordPress path. The commonly used xmlrpc_enabled filter is not sufficient because it does not remove unauthenticated pingback methods.

add_filter( 'xmlrpc_methods', function ( $methods ) {
    unset( $methods['pingback.ping'] );
    unset( $methods['pingback.extensions.getPingbacks'] );
    return $methods;
} );

If XML-RPC is not required, blocking xmlrpc.php at the web server is stronger because the request never reaches PHP. Blocking XML-RPC alone does not protect plugins, oEmbed or feed functionality that performs other outbound requests, so pair it with the temporary libcurl mitigation until Brotli is patched.

Indicators and investigation

Bursts of unauthenticated POST requests to /xmlrpc.php invoking pingback from unusual source URLs.
Apache messages showing a child process exiting with segmentation fault signal 11.
PHP-FPM workers exiting on signal 11 or repeatedly restarting.
Core dumps whose backtrace contains libbrotlidec.so.
PHP or web-server workers stuck at full CPU while related requests time out.
Unexpected outbound requests followed by responses using Content-Encoding: br.
A web-server user process spawning a shell or network utility, which warrants immediate incident response.

# Read-only examples; adjust paths for the host
grep -R -E 'Segmentation fault|signal 11|libbrotlidec' /var/log/apache2 /var/log/php* 2>/dev/null
grep -R -E 'POST /xmlrpc\.php|pingback\.ping' /var/log/nginx /var/log/apache2 2>/dev/null

Preserve access logs, PHP logs, core dumps and outbound-proxy records before cleanup. Repeated crashes show attempted exploitation or denial of service, but they do not by themselves prove successful remote code execution.

Verification checklist

Confirm the operating-system package revision includes the vendor’s CVE-2026-111497 fix.
Restart services or rebuild and redeploy containers after patching.
Confirm pingback.ping is unavailable or xmlrpc.php is blocked if it is not required.
Inventory plugins and themes that fetch visitor-supplied URLs.
Review worker crashes, CPU spikes and outbound HTTP responses from October 27 onward.
Verify ordinary site functions, scheduled feeds, webhooks and remote media imports after applying temporary HTTP restrictions.

WordPress HTTP2Shell Exposure – Brotli Memory Corruption via XML-RPC (CVE-2026-111497)